From 2cf68f4873ead3c9789b73b547b202babc24179f Mon Sep 17 00:00:00 2001 From: pieterlukasse Date: Mon, 18 Sep 2023 16:58:23 +0200 Subject: [PATCH] wip: use custom configuration option --- pom.xml | 3 ++- .../filters/UpdateAccessTokenFilter.java | 27 ++++++++++++------- .../management/AtlasRegularSecurity.java | 5 +++- src/main/resources/application.properties | 3 +++ 4 files changed, 26 insertions(+), 12 deletions(-) diff --git a/pom.xml b/pom.xml index 845032b8ae..4935e8229e 100644 --- a/pom.xml +++ b/pom.xml @@ -82,6 +82,7 @@ ISOLATION_READ_COMMITTED default + DisabledSecurity 43200 http://localhost @@ -226,7 +227,7 @@ false 200 true - debug + info debug info info diff --git a/src/main/java/org/ohdsi/webapi/shiro/filters/UpdateAccessTokenFilter.java b/src/main/java/org/ohdsi/webapi/shiro/filters/UpdateAccessTokenFilter.java index bc2c239d5a..bb38ae9ed7 100644 --- a/src/main/java/org/ohdsi/webapi/shiro/filters/UpdateAccessTokenFilter.java +++ b/src/main/java/org/ohdsi/webapi/shiro/filters/UpdateAccessTokenFilter.java @@ -48,16 +48,19 @@ public class UpdateAccessTokenFilter extends AdviceFilter { private final int tokenExpirationIntervalInSeconds; private final Set defaultRoles; private final String onFailRedirectUrl; + private final String authorizationMode; public UpdateAccessTokenFilter( PermissionManager authorizer, Set defaultRoles, int tokenExpirationIntervalInSeconds, - String onFailRedirectUrl) { + String onFailRedirectUrl, + String authorizationMode) { this.authorizer = authorizer; this.tokenExpirationIntervalInSeconds = tokenExpirationIntervalInSeconds; this.defaultRoles = defaultRoles; this.onFailRedirectUrl = onFailRedirectUrl; + this.authorizationMode = authorizationMode; } @Override @@ -82,7 +85,7 @@ protected boolean preHandle(ServletRequest request, ServletResponse response) th */ ShiroHttpServletRequest requestShiro = (ShiroHttpServletRequest) request; HttpSession shiroSession = requestShiro.getSession(); - if (login == null && shiroSession.getAttribute(CasHandleFilter.CONST_CAS_AUTHN) != null // TODO - can we use something similar to flag that it is a Fence/oid with teamProject? For now we're just fishing it out from the request parameters itself + if (login == null && shiroSession.getAttribute(CasHandleFilter.CONST_CAS_AUTHN) != null && ((String) shiroSession.getAttribute(CasHandleFilter.CONST_CAS_AUTHN)).equalsIgnoreCase("true")) { login = ((Pac4jPrincipal) principal).getProfile().getId(); } @@ -132,17 +135,21 @@ protected boolean preHandle(ServletRequest request, ServletResponse response) th name = login; } try { - // TODO - remove all teamProject roles at start of login (find this place...OR add a new "remove teamproject" filter)... - + logger.debug("AUTHORIZATION_MODE === '{}'", authorizationMode); boolean resetRoles = false; - // check if teamProject is part of the request: - String teamProjectRole = extractTeamProjectFromRequestParameters(request); Set newUserRoles = new HashSet(); - if (teamProjectRole != null) { - // add teamProject as a role in the newUserRoles list: - newUserRoles.add(teamProjectRole); + if (authorizationMode.equals("teamproject")) { + // in case of "teamproject" mode, we want all roles to be reset always, and + // set to only the one requested/found in the request parameters (following lines below): resetRoles = true; - // TODO - double check with Arborist if this role has really been granted to the user.... + // check if a teamproject parameter is found in the request: + String teamProjectRole = extractTeamProjectFromRequestParameters(request); + // if found, add teamproject as a role in the newUserRoles list: + if (teamProjectRole != null) { + newUserRoles.add(teamProjectRole); + // double check with Arborist if this role has really been granted to the user.... + // TODO + } } this.authorizer.registerUser(login, name, defaultRoles, newUserRoles, resetRoles); diff --git a/src/main/java/org/ohdsi/webapi/shiro/management/AtlasRegularSecurity.java b/src/main/java/org/ohdsi/webapi/shiro/management/AtlasRegularSecurity.java index 4fb4e65286..23c8221ec1 100644 --- a/src/main/java/org/ohdsi/webapi/shiro/management/AtlasRegularSecurity.java +++ b/src/main/java/org/ohdsi/webapi/shiro/management/AtlasRegularSecurity.java @@ -253,6 +253,9 @@ public class AtlasRegularSecurity extends AtlasSecurity { @Value("${security.auth.google.enabled}") private boolean googleAuthEnabled; + @Value("${security.ohdsi.custom.authorization.mode}") + private String authorizationMode; + private RestTemplate restTemplate = new RestTemplate(); @Autowired @@ -270,7 +273,7 @@ public Map getFilters() { filters.put(LOGOUT, new LogoutFilter(eventPublisher)); filters.put(UPDATE_TOKEN, new UpdateAccessTokenFilter(this.authorizer, this.defaultRoles, this.tokenExpirationIntervalInSeconds, - this.redirectUrl)); + this.redirectUrl, this.authorizationMode)); filters.put(ACCESS_AUTHC, new GoogleAccessTokenFilter(restTemplate, permissionManager, Collections.emptySet())); filters.put(JWT_AUTHC, new AtlasJwtAuthFilter()); diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index 8143a3b9f9..cc696ba8bc 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -199,6 +199,9 @@ security.auth.ldap.enabled=${security.auth.ldap.enabled} security.auth.ad.enabled=${security.auth.ad.enabled} security.auth.cas.enabled=${security.auth.cas.enabled} +#Authorization config +security.ohdsi.custom.authorization.mode=${security.ohdsi.custom.authorization.mode} + #Execution engine executionengine.updateStatusCallback=${executionengine.updateStatusCallback} executionengine.resultCallback=${executionengine.resultCallback}